Backport #61 to release/3.0: Enable ACL confidential VM boot and harden Azure time synchronization

[Lanze Liu (liulanze)]

Summary

Cherry-pick of #61 (aclmain, 2026-10-10) onto release/3.0, with the patch unchanged.

The ACL-T build checks the stock oem-azure chrony files against pinned hashes. Those pins now match aclmain after #61. Production builds use release/3.0, and since 10-10 they have stopped at that check before producing ACL-T (for example, nightlies 1222252 and 1222253). After this backport, the release/3.0 chrony files are byte-identical to aclmain.

Change Log

• oem-azure chrony payload:
  • chrony.conf drops the unconditional Hyper-V PTP refclock, includes /run/chrony-azure/conf.d, and adds the time.windows.com fallback.
  • The new /usr/libexec/chrony-azure-ptp writes the PTP refclock only when /dev/ptp_hyperv exists.
  • chrony-hyperv.conf runs that script from ExecStartPre and no longer has Wants=dev-ptp_hyperv.device.
• manglefs_rpm.sh: fails on missing chrony inputs, installs chrony-azure-ptp, and removes the chrony-helper remove-daemon-state stop command, which chrony-helper does not implement.
• dracut_install.sh / 99-acl.conf: adds an ordering drop-in that runs decrypt-root.service before initrd-root-device.target.
• Not included: rpm: retain TPM2 Dracut module in VM images #95 (keeps the TPM2 dracut module), which encrypted-root auto-unlock on confidential VMs also needs. Confidential VM boot on release/3.0 is out of scope for this PR.

Type of Change

• Image build change (base image, sysexts, OEM images)
• Package/SPEC update
• CI/automation change
• SDK/toolchain update
• Configuration change
• Documentation update
• Bug fix

Does this affect the image build?

• Yes
• No

Chrony configuration in the Azure OEM payload, plus one initramfs drop-in. aclmain has shipped both since 10-10.

Associated Issues

• Backport of Enable ACL confidential VM boot and harden Azure time synchronization #61.

Test Methodology

• aclmain nightly 1222254 (10-12) includes Enable ACL confidential VM boot and harden Azure time synchronization #61. Stock and ACL-T build, smoke, and kola pass on both architectures. The only failure is GPU kola, and it fails the same way on release/3.0 without Enable ACL confidential VM boot and harden Azure time synchronization #61: kola cannot select a subscription, before any VM is created.
• Clean git cherry-pick -x; bash -n passes on the changed scripts; the sha256 of chrony.conf and chrony-hyperv.conf matches aclmain.
• Production nightly pipelines (amd64 / arm64) built from this branch (aclScriptsRef=user/lanzeliu/backport-61-release-3.0): RUN_AMD64 / RUN_ARM64, RESULTS.
• Required CI checks (github-acl-pr-validation).

Merge Checklist

All applicable boxes should be checked before merging

• Image builds successfully with this change (or image build is not affected)
• Any updated packages/SPECs build successfully
• Relevant kola tests pass
• All package sources are available
• Source files have up-to-date hashes/manifests
• Documentation has been updated to match any changes
• Ready to merge

[Jiri Appl (jiria)]

Is there a good nightly dev run with this payload?

[Lanze Liu (liulanze)]

Is there a good nightly dev run with this payload?

Yes - aclmain nightly 1222254